Microsoft warns fake game and cracked software installers secretly monetise Windows PCs
- Severity
- Medium
- Sources
- 1
What happened
Microsoft Threat Intelligence documented an Inno Setup based campaign, with lures such as cracked games, Roblox executors, auto-clickers and activators, delivering WorldProxyPool (proxyware), CharityEngine, BOINC with VirtualBox, and Advanced Windows Manager. WorldProxyPool persists through scheduled tasks WorldProxyPoolAgent, WorldProxyPoolWatchdog and WorldProxyPoolUpdater running as SYSTEM, with the watchdog running every five minutes and update checks hourly. Defenders should hunt for %TEMP% is-.tmp staged eld.exe payloads, sdk-agent.exe under Program Files, the scheduled tasks and the listed SHA-256 hashes and offer callback domains, and enable cloud-delivered protection, tamper protection and reputation-based controls. No cryptomining was established and no link to other proxyware operators was confirmed.
For security analysts · Written by AI from 1 source · Wrong?
What to do
- Avoid cracked software, unofficial game installers and activation tools.
- Check for unexpected applications and the WorldProxyPool scheduled tasks, and remove them if found.
- Enable cloud-delivered protection, tamper protection and reputation-based controls.
- Review software inventories to find installations that were not intentionally authorised.
Written by AI from the sources, checked against them
Full story timeline · 1 update
Who reported · 1 outlet
Who and what is in it
Companies